PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-6476 PostgreSQL CVE debrief

A SQL injection vulnerability in PostgreSQL's pg_createsubscriber function allows authenticated attackers with pg_create_subscription rights to execute arbitrary SQL commands with superuser privileges. The vulnerability affects PostgreSQL versions 17.0 through 17.9 and 18.0 through 18.3; versions prior to 17.0 are unaffected. The attack vector requires network access and low attack complexity, but high privileges (pg_create_subscription rights). Successful exploitation results in complete confidentiality, integrity, and availability compromise of the database server. The vulnerability was published on 2026-05-14 and last modified on 2026-05-18. No known exploitation in ransomware campaigns has been reported.

Vendor
PostgreSQL
Product
PostgreSQL
CVSS
HIGH 7.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-14
Original CVE updated
2026-05-18
Advisory published
2026-05-14
Advisory updated
2026-05-18

Who should care

Database administrators managing PostgreSQL 17.x or 18.x installations; security teams responsible for database infrastructure; organizations using logical replication with subscription creation capabilities; compliance officers tracking privilege escalation vulnerabilities in database systems

Technical summary

The pg_createsubscriber function in PostgreSQL contains a SQL injection vulnerability that allows attackers with pg_create_subscription rights to inject and execute arbitrary SQL statements. When pg_createsubscriber is next invoked, the injected SQL executes with superuser privileges, granting complete control over the database instance. The vulnerability stems from improper input sanitization within the function's SQL construction logic. Affected versions include PostgreSQL 17.0 through 17.9 and 18.0 through 18.3. The CVSS 3.1 base score of 7.2 reflects high impact (confidentiality, integrity, availability) balanced against high privilege requirements for exploitation.

Defensive priority

HIGH

Recommended defensive actions

  • Upgrade PostgreSQL to version 17.10 or later for version 17.x installations, or version 18.4 or later for version 18.x installations
  • Audit database user accounts and revoke pg_create_subscription privileges from non-essential accounts pending patch deployment
  • Monitor database logs for anomalous pg_createsubscriber execution patterns and unexpected superuser-level operations
  • Review and restrict network access to PostgreSQL instances to authorized administrative hosts only
  • Verify backup integrity and ensure recovery procedures are tested before applying updates in production environments

Evidence notes

Vulnerability confirmed through NVD analysis with vendor advisory from PostgreSQL. CVSS 3.1 vector: AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. CWE-89 (SQL Injection) classification provided by vendor reference.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-6476 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-6476

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-6476 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-6476

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://www.postgresql.org/support/security/CVE-2026-6476/

    f86ef6dc-4d3a-42ad-8f28-e6d5547a5007 - Patch, Vendor Advisory

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.